https://github.com/trailofbits/circomspect

A static analyzer and linter for the Circom zero-knowledge DSL
https://github.com/trailofbits/circomspect

Last synced: 4 days ago
JSON representation

A static analyzer and linter for the Circom zero-knowledge DSL

• Host: GitHub
• URL: https://github.com/trailofbits/circomspect
• Owner: trailofbits
• License: gpl-3.0
• Created: 2022-05-27T13:26:28.000Z (over 2 years ago)
• Default Branch: main
• Last Pushed: 2024-06-22T15:39:04.000Z (4 months ago)
• Last Synced: 2024-10-29T02:39:11.624Z (6 days ago)
• Language: Rust
• Homepage:
• Size: 7.27 MB
• Stars: 229
• Watchers: 16
• Forks: 13
• Open Issues: 6
• Metadata Files:
  • Readme: README.md
  • Changelog: CHANGELOG.md
  • License: LICENSE
  • Codeowners: CODEOWNERS

Awesome Lists containing this project

• awesome-circom - Circomspect
• awesome-circom - Circomspect - static analyzer and linter for the Circom programming language (Code editors & tooling / Cryptographic primitives in other languages)

README

        
# Circomspect 🔎

![Crates.io badge](https://img.shields.io/crates/v/circomspect.svg) ![GitHub badge](https://github.com/trailofbits/circomspect/actions/workflows/ci.yml/badge.svg)

Circomspect is a static analyzer and linter for the [Circom](https://iden3.io/circom) programming language. The codebase borrows heavily from the Rust Circom compiler built by [iden3](https://github.com/iden3).

Circomspect currently implements a number of analysis passes which can identify potential issues in Circom circuits. It is our goal to continue to add new analysis passes to be able to detect more issues in the future.

![Circomspect example image](https://github.com/trailofbits/circomspect/raw/main/doc/circomspect.png)

## Installing Circomspect

Circomspect is available on [crates.io](https://crates.io/crates/circomspect) and can be installed by invoking

```sh

  cargo install circomspect

```

To build Circomspect from source, simply clone the repository and build the

project by running `cargo build` in the project root. To install from source, use

```sh

  cargo install --path cli

```

## Running Circomspect

To run Circomspect on a file or directory, simply run

```sh

  circomspect path/to/circuit

```

By default, Circomspect outputs warnings and errors to stdout. To see informational results as well you can set the output level using the `--level` option. To ignore certain types of results, you can use the `--allow` option together with the corresponding result ID. (The result ID can be obtained by passing the `--verbose` flag to Circomspect.)

To output the results to a Sarif file (which can be read by the [VSCode Sarif Viewer](https://marketplace.visualstudio.com/items?itemName=MS-SarifVSCode.sarif-viewer)), use the option `--sarif-file`.

![VSCode example image](https://github.com/trailofbits/circomspect/raw/main/doc/vscode.png)

Circomspect supports the same curves that Circom does: BN254, BLS12-381, and Goldilocks. If you are using a different curve than the default (BN254) you can set the curve using the command line option `--curve`.

## Analysis Passes

Circomspect implements analysis passes for a number of different types of issues. A complete list, together with a high-level description of each issue, can be found [here](https://github.com/trailofbits/circomspect/blob/main/doc/analysis_passes.md).